Rigging up Roslyn Analyzers in .NET Core

>> Update 06/11/2018.  Damiano Curia has pushed out a "more definitive" post on this topic.  Please check it out at https://curia.me/how-to-configure-code-analysis-in-net-core-projects …

I love Live Code Analyzers in VS2017. The analyzers help identify bad coding patterns, resource leaks and just generally aid one be a better developer by alerting when things are not done optimally.

Fun story - for reals. I was engaged by "big ole firm" to do code analysis on .NET 4.6 system that's "not running so good". About 87000 lines of code. Got code compiling, then had them turn on live analyzers in VS2017. Run an optimized ruleset which includes all the Dispose checks ( which are not included in the "recommended" rule set btw, look for CA2000, not turned on in recommended rules ).

Hmm. 800 lines with potential memory leaks around dispose.

Me to client person - Did you try building the system with the analyzers on?
Client - Yes, we turned them off. There were too many errors.
Me - Sigh. Ok lets start here. Turns on live code analysis.

[caption id="attachment_2885" align="alignright" width="135"] .NET Core Console[/caption]

Today I work in .NET Core more than .NET Framework. But my trusty analyzers are not there. And the Analyzer tools are not yet integrated into the VS2017 IDE as they are for .NET Framework projects.   So let's explore how to put the analyzers into .NET Core projects.

For this exercise I'm starting with a basic .NET Core 2.0 Console project. Tons of improper things that are targets for the Analyzers to find live in the code. Dispose, try/catch, globalization, exceptions and more loom for the unsuspecting developer.  The source for the demo projects may be obtained at https://github.com/jhealy/RoslynAnalyzerProofs .

Rebuild the project and four warnings appear in my Error List in Visual Studio (View->Error List). Notably, these are things I need to fix. But I know there are more errors.

The product group who owns the analyzers recommends people use the publicly released beta analyzers for .NET Core. FxCop is a great starting analyzer library so let's pull in the .NET Core compatible FxCop analyzers from https://www.nuget.org/packages/Microsoft.CodeAnalysis.FxCopAnalyzers/2.3.0-beta1 .

I add the FxCop analyzer to my project using the Manage Nuget Packages window.

Rebuild the project and open the errors window.  There are a TON of errors about "IOperation is disabled" .

To  resolve IOperation is disabled, open your .csproj file.

Then add <Features>IOperation</Features> to the <PropertyGroup> . Screenshot of the .csproj below.

Rebuild the project and we now have 76 warnings in the Error List.  Items such as globalization, public fields, classes that are never instantiated, bad exception practices and more.

Now I'm ready to have some fun.  I add a number of other analyzers to my project.  By opening up Manage Nuget Packages and put Microsoft.CodeAnalysis into the search box, a number of new toys show up.  Below are the results after I add various new analzyers.:

Microsoft.CodeAnalysis - v2.4 - 77 total warnings
Microsoft.CodeAnalysis.Csharp - v2.4 - 77 total warnings
Roslynator.Analyzers - v1.5.0 - 87 total warnings
SonarAnalyzer.Csharp - v6.6.0.3 - 131 total warnings, 9 messages
Microsoft.CodeAnalysis.Analyzers - v2.3.0-beta1 - 131 total warnings

Note the Core Analyzers have not caught up with the .NET analyzers - yet. Running the full set of analyzers in .NET Core with just FxCop yields five warnings on the current document. Running the stock analyzers on .NET yields 13 warnings. One if these is a CA2000 Dispose warning, which always concern me. Unfortunately I can't get Dispose warnings to surface in the .NET Core analyzers yet.

[caption id="attachment_2917" align="aligncenter" width="1024"] Core Analyzer Results[/caption]

[caption id="attachment_2925" align="aligncenter" width="1024"] .NET Analyzer Result[/caption]

Preview analyzers are available at [ https://dotnet.myget.org/gallery/roslyn-analyzers ]. These will be available with Visual Studio2017 version 15.5. I tried to get them working with Visual Studio 2017 v15.3 and v15.4 to no avail. Posted an issue and was advised to the PG to sit a bit and wait, good stuff is coming soon. So I’m in a hurry up and wait scenario. See the thread here for the fun of trying to get the preview working [ https://github.com/dotnet/roslyn/issues/23083 ]. I'll post a revised article once version 15.5 releases.

The source for the demo projects may be obtained at https://github.com/jhealy/RoslynAnalyzerProofs .

The information in this blog post is current as of November 10, 2017 and is subject to change with new VS and Analyzer releases. Visual Studio 2017 Version 15.4.4, .NET Core 2.0.2.

Happy coding and carpe diem...